29
Dec 2011
2 Comments
Sigh, denial-of-service notes published over holidays

It’s 5am, I haven’t slept. A critical ASP.NET security update is being issued out-of-band today. Immediately, I sprung into “what the hell, Microsoft?” mode, given our government (US-CERT) indicated Microsoft was contacted about this back on November 1. (And the fact I have to worry about ChevronWP7 Labs on Azure and our product at work.) I went as far as to complain on Twitter, my channel of choice. But a few Microsoft folks pinged me, forcing me to do some fact checking.

Yep. I should’ve known not to blindly trust what was on US-CERT, sigh.

Upon inspection of the actual disclosure one area jumped out at me:

Vendor communication:
2011/11/01 Coordinated notification to PHP, Oracle, Python, Ruby, Google
via oCERT

2011/11/29 Coordinated notification to Microsoft via CERT

Yep. These guys waited an arbitrary 30 days (in reality, less) before publishing it to the world. Never mind that this issue affected Microsoft .NET Framework 1.0 and up. Never mind that this framework has been built into Windows since Windows XP. Never mind patches for all these platforms have to be engineered and tested. Never mind it’s the fucking holidays and people have families they’re spending time with. Never mind this doesn’t just affect ASP.NET but also web frameworks written in Java, Python, Ruby, PHP, and JavaScript (think node).

I couldn’t find a shred of evidence to suggest this flaw was being exploited by malicious actors or that the information was discovered by other folks – possible reasons that would have explained such a disclosure. This appears to just be a classic case of dirtbagery.

Here’s how the adults handle this, take notes guys:

  • Jeroen Frijters

    While I’m in total agreement with you (I was actually returning from vacation and installed the patches on our production systems while waiting at JFK airport), the youtube video just pisses me off. I’ve (responsibly) reported several vulnerabilities to Microsoft and their response is not that great. The fact that it takes them forever to publish fixes *and* that that have zero accountability about this makes this “Coordinated” just marketing bullshit. I very much understand the challenge they face in testing for the many configurations they support, but I still feel that they take more time than necessary to release patches (and since they are not at all transparent about it, they’ve never showed me anything to convince me otherwise).

  • Jack in the box

    thats what you get using garbage .net